Subject: RE: [mobile-ip] RFC3012bis - Comments from ADs (Protocol related ) (ISSUE No. 2)

From: "Ahmad Muhanna" <[email-masked]>
Date: Thu, 26 Sep 2002 09:04:26 -0500

Please see comments inline.

Regards;
Ahmad Muhanna

Non-editorial comments associated with RFC3012bis:

Please post your comments with the appropriate issue number in the subject
line (instead of simply replying to this email).

-Chairs.

2. Section 3.1:
   Whenever the Agent Advertisement contains the Challenge extension, if
   the mobile node does not have a security association with the Foreign
   Agent, then it MUST include the Challenge value in a Mobile-Foreign
   Challenge extension to the Registration Request message.  If, on
   the other hand, the mobile node does have a security association
   with the foreign agent, it SHOULD include the Challenge value in its
   Registration Request message.

   Why the "SHOULD"? What breaks if it doesn't include it?
   One would naively assume that it is has a MN-FA SA that there is
   no need for the challenge.

Since there is no mechanism for Replay Protection between the MN and the
Foreign Agent,
My understanding is that the MN-FA Challenge extension provides this
mechanism in addition 
to the AAA authentication.

Having said that, I believe the MN MUST always include the MN-FA Challenge
extension
regardless if the MN has a security association with the Foreign Agent or
not.
However, the wisdom behind making it SHOULD in the case when the MN does
have a 
security association with the Foreign Agent is quite clear.!! "Backward
Compatibility"

What if we have a MN out there which does not understand MN-FA Challenge
extension and at
the same time is ONLY RFC2002 compliant. Meaning, it has a security
association with the 
Foreign Agent. If we make it a MUST this MN is no longer eligible to receive
service. 
On the other hand, If we remove SHOULD all together, we lose the benefit of
Replay Protection 
mechanism for those MN which has a security association with the Foreign
Agent and at the 
same time understand MN-FA Challenge extension. "Also forward compatibility
when we have a 
mechanism to dynamically establish a security association between the MN and
the Foreign Agent 
AND the MN understand MN-FA Challenge extension for replay protection."

Regards,
Ahmad Muhanna